Webhooks

{
    "id": "680a2a9b00ae350518588834",
    "account_id": "680a2a9b00ae350518581277",
    "source_id": "680a2a9b00ae350518580034",
    "source": "Card",
    "status": "Declined/Canceled/Pending/Approved",
    "side": "Credit/Debit",
    "amount": 100,
    "currency": "USD",
    "type": "Card",
    "created_at": "2025-04-24T12:12:11.347+00:00",
    "updated_at": "2025-04-24T12:12:11.347+00:00",
    "card": {
      "id": "680a2a9b00ae350518580034",
      "masked_PAN": "4302 63** **** 1234",
      "name": "TestCard",
    },
    "card_data": {
      "merchant_name": "FACEBOOK",
      "original_amount": 98,
      "original_currency": "EUR",
      "decline_code": "01/02/03/04/10",
    },
    "webhook_type": "Transaction",
}

{
  "id": "680a2a9b00ae350518581234",
  "account_id": "680a2a9b00ae350518589904",
  "card_id": "680a2a9b00ae354878586604",
  "amount": 100,
  "currency": "USD",
  "created_at": "2025-04-24T12:12:11.347+00:00",
  "updated_at": "2025-04-24T12:12:11.347+00:00",
  "card": {
    "id": "680a2a9b00ae354878586604",
    "masked_PAN": "4302 63** **** 1234",
    "name": "Test Card",
  },
  "webhook_type": "Otp",
}

import hmac
import hashlib
import json

def verify_webhook_signature(payload: dict, received_signature: str, secret: str) -> bool:
    expected_signature = hmac.new(
        secret.encode(),
        json.dumps(payload, separators=(',', ':')).encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected_signature, received_signature)

# Function call example
payload = {"event": "payment", "amount": 100}
secret = "your_secret_key"
received_signature = "signature_from_headers"

print(verify_webhook_signature(payload, received_signature, secret))

const crypto = require('crypto');

function verifyWebhookSignature(payload, receivedSignature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(receivedSignature));
}

// Function call example
const payload = { event: "payment", amount: 100 };
const secret = "your_secret_key";
const receivedSignature = "signature_from_headers";

console.log(verifyWebhookSignature(payload, receivedSignature, secret));

<?php
function verify_webhook_signature($payload, $received_signature, $secret) {
    $expected_signature = hash_hmac("sha256", json_encode($payload), $secret);
    return hash_equals($expected_signature, $received_signature);
}

// Function call example
$payload = ["event" => "payment", "amount" => 100];
$secret = "your_secret_key";
$received_signature = "signature_from_headers";

var_dump(verify_webhook_signature($payload, $received_signature, $secret));

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
)

func verifyWebhookSignature(payload map[string]interface{}, receivedSignature string, secret string) bool {
	jsonPayload, _ := json.Marshal(payload)
	h := hmac.New(sha256.New, []byte(secret))
	h.Write(jsonPayload)
	expectedSignature := hex.EncodeToString(h.Sum(nil))
	return hmac.Equal([]byte(expectedSignature), []byte(receivedSignature))
}

func main() {
	payload := map[string]interface{}{
		"event":  "payment",
		"amount": 100,
	}
	secret := "your_secret_key"
	receivedSignature := "signature_from_headers"

	fmt.Println(verifyWebhookSignature(payload, receivedSignature, secret))
}